AWL problems

Martin Hepworth martinh at SOLID-STATE-LOGIC.COM
Wed Apr 27 16:50:31 IST 2005


Dave

ah that's the problem then Ensim's calling SA outside of MS.....yes it
gives per user control but can give issues. (also will be MS 4.36 I
guess as 4.41 is latest beta)

The more I hear about ensim the less i like it, and they don't give
Julian any 'help' just take the code.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Dave Duffner - PSCGi wrote:
> Martin,
>
>         Ensim's whacky modification of the MS/SA package in
> their Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard
> by any means.  I've asked 1,000 times for someone to clarify
> how the mail is passed through the processes to determine
> which 'entity' gets what when in order to fix problems like
> this and others where it's tagged strangely.
>
>         Ensim does use a fully chrooted environment, which I
> know drives everyone insane, but may be part of the problem.
> Not sure what Chris is using to know if we match or if he
> has a totally different setup with the same problem.
>
>         In my case, I'm told mail is handled as follows:
>
>         In to MailScanner (currently 4.63 I believe?)
>         MS checks it against my internal and externally selected BL's
>         If MS tags it as spam, we changed it to read [Spam-MS]
>         If it's tagged, depending on the settings it's delivered
>                 as an attachment or dumped at that point.
>         If it passes cleanly, then it's tossed to SpamAssassin
>                 (currently the 3.02 patch from Ensim version)
>         SA then uses my rulesets to determine if it is to be
>                 checked and not whitelisted (not AWL'ed)
>         If pass, then SA performs my ruleset checks for spam
>                 (RulesdeJour & custom rulesets, etc.)
>         If SA finds it as Spam, tags it [SA-Spam] so we know which
>                 process did what to it.
>         If passed or below the threshold, delivered to User.
>
>         Now, from what little I can gather from Ensim folks &
> forums, these processes should be running as 'root'.  One thing
> that never surfaced until you mentioned it here was the fact
> that Ensim (or something) is writing a .spamassassin dir in
> each domain and for each user that holds the Bayes & AWL info
> along with anything else specific for that User.
>
>         Reason here may be that Ensim Pro gives the option to
> have spam handling done via the GUI either by just the server
> alone or optionally by each User in their GUI.  They get to
> set the threshold of spam, personal whitelists, etc. and
> determine if it should hold spam or just delete it if it's
> been tagged by SA.  MS tagging is prior to SA handling, so
> any options picked by the User would only apply if SA got to
> process the mail in question.  We have User Spam Controls
> turned on as a percentage of our Users like the more direct
> control and it saves us hassles of 'censorship' if we were
> the only party determining what's spam and what's not.
>
>         Again, I did go in and nail the AWL file for the account
> I get MailScanner mail to.  That did stop the AWL rating from
> appearing until it had built a file back up.  I can't find a
> spot to stop SA from creating that file once I've deleted it,
> I'm presuming that's my whole problem there.
>
>         As a side note, I've also noticed MS skipping some
> e-mails, we don't do a volume where that should be happening
> but I did increase some settings that seem to have lowered
> the skip rate to a level we can deal with.
>
>         There is an option with this Ensim goofy setup to
> double-run SA if you change the MailScanner.conf file, but
> we have that set to only use the SA prefs file and all those
> settings in the MS.conf file are disabled/commented out, etc.
> So as far as I can see, the flow above is what's happening
> and MS is the lead application in handling mail to be scanned.
>
>         Any questions, don't hestitate to fire away!
>
>         Thanks,
>
>         Dave
>
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Martin Hepworth
>>Sent: Wednesday, April 27, 2005 11:14 AM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: AWL problems
>>
>>
>>Dave
>>
>>the awl will (should) only get created for the user
>>MailScanner runs as.
>>
>>Are you sure you're running SA from the MTA/procmail etc??
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Dave Duffner - PSCGi wrote:
>>
>>>        See now he's hitting the same wall I am...
>>>
>>>        Even deleting the AWL's for the individual accounts, MS is
>>>still compiling the AWL file.  And that's with all the
>>
>>config points
>>
>>>possible turned off, MS indicating that autolearn is disabled.
>>>
>>>        Since deleting the AWL file in the .spamassassin
>>
>>dir for each
>>
>>>user, it's lowered the point value back down to 0.0 and then starts
>>>averaging it back up.  Julian's ratings for his posts here
>>
>>that I get
>>
>>>stopped AWL rating it, then started with a 0.0 and as I get more of
>>>his posts I think we're up to a 0.9 rating.  Once it sees enough of
>>>his posts, it'll be back to tagging his mail until I kill that AWL
>>>file in that account's dir again.
>>>
>>>        Chris may not be that far along in the process yet, but it
>>>certainly sounds like he's heading in that direction.
>>>
>>>        So either we've got a weird bug or there's some
>>
>>setting being
>>
>>>overridden or hidden somewhere so deep that it's triggering the AWL
>>>ratings again.  And with a ton of accounts, that's a serious PIA to
>>>have to manually delete AWL files on a constant basis to
>>
>>kill it off.
>>
>>>        I'm open for any suggestions, scripts, cron jobs or
>>
>>otherwise
>>
>>>to get that fool thing stopped.  In our case we're using an Ensim
>>>Hosting OS, so we're stuck with 3.XX of SA as any upgrades that
>>>might've fixed this would either foul up Ensim or be overwritten in
>>>the next half-a'ed upgrade or patch from Ensim for the OS.
>>>
>>>     David J. Duffner
>>>     President
>>>     PSCGi
>>>     Paradise Shore Communications Group
>>>     www.pscginternet.com
>>>
>>>
>>>
>>>
>>>>-----Original Message-----
>>>>From: MailScanner mailing list
>>
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>>
>>>>Behalf Of Martin Hepworth
>>>>Sent: Wednesday, April 27, 2005 10:49 AM
>>>>To: MAILSCANNER at JISCMAIL.AC.UK
>>>>Subject: Re: AWL problems
>>>>
>>>>
>>>>Chris
>>>>
>>>>if you're using SA 3.x this doesn't work. You'll need to
>>
>>turn it off
>>
>>>>in the SA config files.
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>Fractal IT Dept. wrote:
>>>>
>>>>
>>>>>Hi everyone,
>>>>>
>>>>>I'm having a problem with ham becoming spam because it
>>
>>receives AWL
>>
>>>>>points. I'm not sure why this is happening, because in my
>>>>>mailscanner.conf file, I have:
>>>>>
>>>>>SpamAssassin Auto Whitelist = no
>>>>>
>>>>>Any thoughts as to what could possibly be causing this?
>>>>>
>>>>>Thanks,
>>>>>Chris
>>>
>>>
>>>
>>>I--I
>>>Message scanned by MailScanner, and is believed to be clean.
>>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>
>>specified
>>
>>>destination and person.  If this is not you, this
>>>e-mail must be deleted immediately.     www.pscginternet.com
>>>
>>>------------------------ MailScanner list
>>
>>------------------------ To
>>
>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>mailscanner' in the body of the email. Before posting, read
>>
>>the Wiki
>>
>>>(http://wiki.mailscanner.info/) and the archives
>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential
>>and intended solely for the use of the individual or entity
>>to whom they are addressed. If you have received this email
>>in error please notify the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list
>>------------------------ To unsubscribe, email
>>jiscmail at jiscmail.ac.uk with the words: 'leave mailscanner'
>>in the body of the email. Before posting, read the Wiki
>>(http://wiki.mailscanner.info/) and the archives
>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>I--I
>>Message scanned by MailScanner, and is believed to be clean.
>>CONFIDENTIALITY NOTICE:  This transmission intended for the
>>specified destination and person.  If this is not you, this
>>e-mail must be deleted immediately.     www.pscginternet.com
>>
>
>
>
> I--I
> Message scanned by MailScanner, and is believed to be clean.
> CONFIDENTIALITY NOTICE:  This transmission intended for the
> specified destination and person.  If this is not you, this
> e-mail must be deleted immediately.     www.pscginternet.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list